Re: [PATCH 2/3] scsi: ufs: bsg: Clear the UIC result byte before sending UIC commands

[Bart Van Assche]

On 10/13/26 3:29 AM, Stanley Jhu wrote:
> ufs_bsg_request() passes the user-supplied UIC argument2 unchanged,
> including the result byte (bits 7:0) that only the host controller
> writes. A non-zero value triggers the WARN_ON_ONCE() in
> ufshcd_dispatch_uic_cmd() and corrupts the reported result. Found by
> syzkaller.
>
> Clear the result byte before sending the command.
>
> Fixes: e77044c5a842 ("scsi: ufs-bsg: Add support for uic commands in ufs_bsg_request()")
> Fixes: 9fb4c793223b ("scsi: ufs: core: Complain if UIC argument 2 is invalid")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Stanley Jhu <stanleyjhu@xxxxxxxxxx>
> ---
>   drivers/ufs/core/ufs_bsg.c | 1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/drivers/ufs/core/ufs_bsg.c b/drivers/ufs/core/ufs_bsg.c
> index dab1f05aff38..331ead0403a1 100644
> --- a/drivers/ufs/core/ufs_bsg.c
> +++ b/drivers/ufs/core/ufs_bsg.c
> @@ -179,6 +179,7 @@ static int ufs_bsg_request(struct bsg_job *job)
>   		break;
>   	case UPIU_TRANSACTION_UIC_CMD:
>   		memcpy(&uc, &bsg_request->upiu_req.uc, UIC_CMD_SIZE);
> +		uc.argument2 &= ~MASK_UIC_COMMAND_RESULT;
>   		ret = ufshcd_send_bsg_uic_cmd(hba, &uc);
>   		if (ret)
>   			dev_err(hba->dev, "send uic cmd: error code %d\n", ret);

Shouldn't invalid inputs be rejected rather than trying to correct these?

Thanks,

Bart.